Modulation- or steady-state approaches, as the name suggests, make use of errors in the modulated signal.
The seminal work of Brik et al. [1]} proposes to collect the fingerprints from five features of the modulated signal, that is, magnitude, phase and frequency error, I/Q origin offset, and SYNC correlation. They show experimentally that their solutions, called PARADIS, can differentiate among 130 identical IEEE 802.11b devices with an accuracy above 99% even under mobility and varying noise conditions. Similar to the transient-based approaches, their approach requires additional equipment since they rely on high-end vector analyzers for channel sampling. Motivated by their work, recent approaches [2]}, [3]} propose to use the CSI obtained from the pilot symbols which are readily available on WiFi chipsets, such as the Intel 5300 or Atheros AR9380. Specifically, Hua et al. [3]} propose to compute the fingerprint using a combination of CFO extracted from the CSI and TDoA computed from capturing 5000 adjacent frames. Furthermore, they require the device to remain stationary for at least 10 seconds for authenticating a device based on the previously collected fingerprint. The most recent work on radiometric fingerprinting [2]} makes use of the non-linear phase errors extracted from CSI. Their work takes advantage of non-linear phase error extraction methods proposed by Zhuo et al. in [6]}. In this paper, we work toward obfuscating the radiometric fingerprints caused by non-linear phase errors [2]}, [6]} since it neither relies on RF equipment with very high sampling rates nor requires large number of frames or stationary user behavior for fingerprinting. Nonetheless, RF-Veil's approach can be extended to other features of the signal, which is controllable at the chipset, such as CFO and amplitude.
